The point of the embargo was to prevent all rumors? But it did not hold.
Anyway, GPs point is that even if nobody leaked anything, and the only thing publicly known was the existence of the bugs, people would anyway have been able to find them independently. So what is the purpose of waiting 24h before releasing the patches?
I can say with high confidence that Nginx, Apache and IIS have a critical security vulnerability hidden somewhere in their codebase right now.
Please provide the prompt that uncovers it. Apparently knowing about the existence of bugs is enough nowadays right?
I’ll wait.
Chainguard had a vague inkling that there was something in PHP and literally typed “find bad vulnerabilities in PHP” to a frontier model and independently discovered these.
What happens when you type the same into any other language is an exercise for the reader.
2. Even if it hadn't, some occurrence of any given event has to be the first
3. Who claimed no other targets are vulnerable in the same way?
> Exercise for the reader. Well, if you are so confident, go do it. Share your results. I bet you won’t find a thing.
https://en.wikipedia.org/wiki/Flydubai_Flight_1073
Since you haven't seen any commenter here on HN go out and rent a 737 and personally demonstrate it to you, it should be totally impossible right?
Let me tell you this: - I never said VR & ED was impossible. I never said that a passenger flying a 747 was impossible either. - I said, a rumour of something so generic as “a bug exists somewhere”, does absolutely nothing for the ability to pull something off. Not before, and not now.
However, that is exactly what you wrote. Then, in your previous comment, you are changing what you said and now you’re fighting a straw man.
Goodbye dude, I’m not spending more cycles on this. Go find some bugs lol.
> you are changing what you said and now you’re fighting a straw man.
Not really. I think the issue is just reading comprehension on your part. Go back and read my original comment again and see if you understand it better this time. You made a ridiculous argument, which I responded to, how is that a strawman?
> Go find some bugs lol
I still don't understand what your deal is? Why do you think I'd be interested in that? It seems like a pretty basic concept that a person can know of a thing being possible without being personally interested in doing it?
> Me: AI models can solve open math problems
> You: Well then go do that and come back with a proof of [insert whatever conjecture]. I'll wait.
What you're saying is "I don't believe it's possible to do thing X unless you personally demonstrate it to me, despite the fact it's verifiably been done before by others".
I'm not claiming I personally will find any critical security vulnerabilities in "Nginx, Apache and IIS". But you seem to be claiming that nobody in the world ever will?
> “[…] even if nobody leaked anything, and the only thing publicly known was the existence of the bugs, people would anyway have been able to find them independently.”
I never said it’s impossible for LLMs to assist or drive VR and exploit development. It’s just utter nonsense that “knowing that a bug exists” does anything meaningful for finding it independently, unless that bug contains signal.
Which it only does if an embargo is broken, which was the case here.
Yes, saying there’s a big bug increases exposure, but also makes people prepared to patch. So it’s a trade-off.
No, when there’s no info provided regarding what the bug is, then it doesn’t make finding the bug more likely for any independent researcher.
Yes, increased exposure does increase the overall likelihood. Duh.
However, all this was not the case, the point here is: someone broke the embargo, and that messed the disclosure up, and that caused this mess.
Go find another straw man to practice mental gymnastics on. I’m not your guy.
See, I think the issue is that you misread my original comment, because this is an entirely wrong interpretation of it. Obviously I'm not saying that for any one given researcher who's already chosen to focus on PHP, that changes anything.
I suppose all your whining about strawmen and mental gymnastics is just you being unwilling to accept that (a) you misread my comment and (b) your reasoning in your reply was entirely illogical.
You know you can just stop replying if you want right? No need to tell me about it.
Chainguard was definitely not in the right here.